CVE-2026-5862
Published: 08 April 2026
Summary
CVE-2026-5862 is a high-severity an unspecified weakness vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 21.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5862 is a high-severity vulnerability stemming from an inappropriate implementation in the V8 JavaScript engine within Google Chrome versions prior to 147.0.7727.55. It enables a remote attacker to execute arbitrary code inside the browser's sandbox through a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8, reflecting its network accessibility, low attack complexity, lack of required privileges, and high impacts on confidentiality, integrity, and availability.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, such as by clicking a link or loading content. No special privileges are needed, but user interaction is required. Successful exploitation allows arbitrary code execution confined to the sandbox, potentially leading to further compromise if chained with other flaws, though it does not escape the sandbox on its own.
Mitigation is addressed in the Chrome stable channel update announced at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html, which patches the issue in version 147.0.7727.55 and later. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/470566252. Security practitioners should prioritize updating affected Chrome installations to the patched version.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20658
Vulnerability details
Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables remote arbitrary code execution in Chrome browser sandbox via crafted HTML page tricked via malicious website visit or link click, directly mapping to Drive-by Compromise (T1189) and Exploitation for Client Execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and patching of the V8 implementation flaw in Chrome prior to 147.0.7727.55 to prevent arbitrary code execution inside the sandbox.
Mandates vulnerability scanning and monitoring to detect Chrome installations vulnerable to CVE-2026-5862 and remediate them based on risk assessments.
Facilitates rapid awareness of the Chrome stable channel update for CVE-2026-5862 by receiving and disseminating security advisories and directives.